[Bug]: Provider producing inconsistent final plan - aws_s3_bucket and default_tags at provider

[Mralbert93]

Terraform Core Version

1.4.2

AWS Provider Version

4.63.0

Affected Resource(s)

aws_s3_bucket

Expected Behavior

S3 bucket should be able to be created when default_tags are configured at provider level.

Actual Behavior

Run errors during apply phase.

Relevant Error/Panic Output Snippet

╷
│ Error: Provider produced inconsistent final plan
│
│ When expanding the plan for aws_s3_bucket.example to include new values
│ learned so far during apply, provider "registry.terraform.io/hashicorp/aws"
│ produced an invalid new value for .tags_all: new element "created" has
│ appeared.
│
│ This is a bug in the provider, which should be reported in the provider's
│ own issue tracker.
╵
Operation failed: failed running terraform apply (exit 1)

Terraform Configuration Files

provider "aws" {
  region = "us-east-1"
  default_tags {
    tags = {
      created = timestamp()
    }
  }
}

locals {
  tags = {
    environment = "test"
    type        = "new"
  }
}

resource "aws_s3_bucket" "example" {
  bucket = "my-bucket-for-testing-broken-things"
  tags = local.tags
}

Steps to Reproduce

1. terraform init
2. terraform apply-auto-approve

Debug Output

No response

Panic Output

No response

Important Factoids

No response

References

#29842

Would you like to implement a fix?

None

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[bion]

Seeing a similar error:

╷
│ Error: Provider produced inconsistent final plan
│ 
│ When expanding the plan for module.ecs_fargate_service.module.ecs-alb[0].module.lb_logs_s3[0].aws_s3_bucket.logs to
│ include new values learned so far during apply, provider "registry.terraform.io/hashicorp/aws" produced an invalid
│ new value for .tags_all: new element "Name" has appeared.
│ 
│ This is a bug in the provider, which should be reported in the provider's own issue tracker.
╵
╷
│ Error: Provider produced inconsistent final plan
│ 
│ When expanding the plan for module.ecs_fargate_service.module.ecs-alb[0].module.lb_logs_s3[0].aws_s3_bucket.logs to
│ include new values learned so far during apply, provider "registry.terraform.io/hashicorp/aws" produced an invalid
│ new value for .tags_all: new element "Type" has appeared.
│ 
│ This is a bug in the provider, which should be reported in the provider's own issue tracker.
╵

Our code is open source and visible here: https://github.com/civiform/cloud-deploy-infra/blob/main/cloud/aws/templates/aws_oidc/filestorage.tf#L95

[johnsonaj]

we have done work to allow resource tags to be computed values. This update will be released in v5.0.0 of the provider.

It is still not possible to have computed values on the provider level default_tags block. This is due to limitations on how the provider is configured, and how these default_tags are applied to resources downstream.

The following configuration will be possible in v5.0.0

provider "aws" {
  region = "us-west-2"
  default_tags {
    tags = {
        key1 = "value1"
    }
}

resource "aws_s3_bucket" "example" {
  bucket = "example-bucket"
  tags = {
    created_at = timestamp()
  }
}

However, the follow will still not compute correctly because default_tags must be known values

provider "aws" {
  region = "us-west-2"
  default_tags {
    tags = {
        created_at = timestamp()
    }
  }
}

resource "aws_s3_bucket" "example" {
  bucket = "example-bucket"
  tags     = {
    additional_tag = "value"
  }
}

[jar-b]

Related update - the plantimestamp function (available with Terraform 1.5+) can be used with default_tags as the value will be known at apply time. This comment includes a minimal reproduction demonstrating the plan/apply output with this approach.

[github-actions]

This functionality has been released in v5.40.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.